Skip to content

Commit e055a18

Browse files
author
Richard Jones
committed
merge from HEAD
1 parent 290b37a commit e055a18

File tree

5 files changed

+49
-80
lines changed

5 files changed

+49
-80
lines changed

‎CHANGES.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ Fixed:
1111
- 'roundup-server -S' always writes [trackers] section heading (sf bug 1088878)
1212
- fix port number as int in mysql connection info (sf bug 1082530)
1313
- fix setup.py to work with <Python2.3 (sf bug 1082801)
14+
- fix permissions checks in cgi templating (sf bug 1082755)
1415

1516

1617
2004-12-08 0.8.0b1

‎doc/announcement.txt‎

Lines changed: 2 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -9,21 +9,8 @@ together a What's New page:
99

1010
http://roundup.sourceforge.net/doc-0.8/whatsnew-0.8.html
1111

12-
Some highlights:
13-
14-
* i18n of the user interface (not just web),
15-
* a re-working of the tracker home configuration to make it much cleaner,
16-
* many speed optimisations,
17-
* integration of the python logging module,
18-
* optional configuration of roundup-server through a configuration file,
19-
* creation of items check the new Create Permission rather than Edit now,
20-
* Permissions may be defined on a per-property basis,
21-
* Permissions may include a fragment of code to run to check,
22-
* optional HTTP Basic auth built in (Apache not required),
23-
* optional HTTP charset selection,
24-
* added mod_python interface,
25-
* optional instant web registration (rather than email confirmation), and
26-
* 30 or so other little feature additions...
12+
This is a bugfix release, fixing:
13+
2714

2815
If you're upgrading from an older version of Roundup you *must* follow
2916
the "Software Upgrade" guidelines given in the maintenance documentation.

‎roundup/cgi/templating.py‎

Lines changed: 42 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -645,8 +645,12 @@ def classhelp(self, properties=None, label=''"(list)", width='500',
645645

646646
def submit(self, label=''"Submit New Entry"):
647647
''' Generate a submit button (and action hidden element)
648+
649+
Generate nothing if we're not editable.
648650
'''
649-
self.edit_check()
651+
if not self.is_edit_ok():
652+
return ''
653+
650654
return self.input(type="hidden", name="@action", value="new") + \
651655
'\n' + \
652656
self.input(type="submit", name="submit", value=self._(label))
@@ -1171,37 +1175,33 @@ def field(self, size = 30):
11711175
11721176
If not editable, just display the value via plain().
11731177
'''
1174-
self.edit_check()
1178+
if not self.is_edit_ok():
1179+
return self.plain()
11751180

11761181
if self._value is None:
11771182
value = ''
11781183
else:
11791184
value = cgi.escape(str(self._value))
11801185

1181-
if self.is_edit_ok():
1182-
value = '&quot;'.join(value.split('"'))
1183-
return self.input(name=self._formname,value=value,size=size)
1184-
1185-
return self.plain()
1186+
value = '&quot;'.join(value.split('"'))
1187+
return self.input(name=self._formname,value=value,size=size)
11861188

11871189
def multiline(self, escape=0, rows=5, cols=40):
11881190
''' Render a multiline form edit field for the property.
11891191
11901192
If not editable, just display the plain() value in a <pre> tag.
11911193
'''
1192-
self.edit_check()
1194+
if not self.is_edit_ok():
1195+
return '<pre>%s</pre>'%self.plain()
11931196

11941197
if self._value is None:
11951198
value = ''
11961199
else:
11971200
value = cgi.escape(str(self._value))
11981201

1199-
if self.is_edit_ok():
1200-
value = '&quot;'.join(value.split('"'))
1201-
return '<textarea name="%s" rows="%s" cols="%s">%s</textarea>'%(
1202-
self._formname, rows, cols, value)
1203-
1204-
return '<pre>%s</pre>'%self.plain()
1202+
value = '&quot;'.join(value.split('"'))
1203+
return '<textarea name="%s" rows="%s" cols="%s">%s</textarea>'%(
1204+
self._formname, rows, cols, value)
12051205

12061206
def email(self, escape=1):
12071207
''' Render the value of the property as an obscured email address
@@ -1238,12 +1238,10 @@ def field(self, size = 30):
12381238
12391239
If not editable, just display the value via plain().
12401240
'''
1241-
self.edit_check()
1242-
1243-
if self.is_edit_ok():
1244-
return self.input(type="password", name=self._formname, size=size)
1241+
if not self.is_edit_ok():
1242+
return self.plain()
12451243

1246-
return self.plain()
1244+
return self.input(type="password", name=self._formname, size=size)
12471245

12481246
def confirm(self, size = 30):
12491247
''' Render a second form edit field for the property, used for
@@ -1252,13 +1250,11 @@ def confirm(self, size = 30):
12521250
12531251
If not editable, display nothing.
12541252
'''
1255-
self.edit_check()
1256-
1257-
if self.is_edit_ok():
1258-
return self.input(type="password",
1259-
name="@confirm@%s"%self._formname, size=size)
1253+
if not self.is_edit_ok():
1254+
return ''
12601255

1261-
return ''
1256+
return self.input(type="password",
1257+
name="@confirm@%s"%self._formname, size=size)
12621258

12631259
class NumberHTMLProperty(HTMLProperty):
12641260
def plain(self):
@@ -1276,18 +1272,16 @@ def field(self, size = 30):
12761272
12771273
If not editable, just display the value via plain().
12781274
'''
1279-
self.edit_check()
1275+
if not self.is_edit_ok():
1276+
return self.plain()
12801277

12811278
if self._value is None:
12821279
value = ''
12831280
else:
12841281
value = cgi.escape(str(self._value))
12851282

1286-
if self.is_edit_ok():
1287-
value = '&quot;'.join(value.split('"'))
1288-
return self.input(name=self._formname,value=value,size=size)
1289-
1290-
return self.plain()
1283+
value = '&quot;'.join(value.split('"'))
1284+
return self.input(name=self._formname,value=value,size=size)
12911285

12921286
def __int__(self):
12931287
''' Return an int of me
@@ -1315,8 +1309,6 @@ def field(self):
13151309
13161310
If not editable, just display the value via plain().
13171311
'''
1318-
self.edit_check()
1319-
13201312
if not self.is_edit_ok():
13211313
return self.plain()
13221314

@@ -1368,18 +1360,18 @@ def now(self, str_interval=None):
13681360
'''
13691361
self.view_check()
13701362

1371-
ret = date.Date('.', translator=self._client)
1363+
ret = date.Date('.', translator=self._client)
13721364

1373-
if isinstance(str_interval, basestring):
1374-
sign = 1
1375-
if str_interval[0] == '-':
1376-
sign = -1
1377-
str_interval = str_interval[1:]
1378-
interval = date.Interval(str_interval, translator=self._client)
1379-
if sign > 0:
1380-
ret = ret + interval
1381-
else:
1382-
ret = ret - interval
1365+
if isinstance(str_interval, basestring):
1366+
sign = 1
1367+
if str_interval[0] == '-':
1368+
sign = -1
1369+
str_interval = str_interval[1:]
1370+
interval = date.Interval(str_interval, translator=self._client)
1371+
if sign > 0:
1372+
ret = ret + interval
1373+
else:
1374+
ret = ret - interval
13831375

13841376
return DateHTMLProperty(self._client, self._classname, self._nodeid,
13851377
self._prop, self._formname, ret)
@@ -1391,7 +1383,6 @@ def field(self, size=30, default=None, format=_marker):
13911383
13921384
The format string is a standard python strftime format string.
13931385
'''
1394-
self.edit_check()
13951386
if not self.is_edit_ok():
13961387
if format is self._marker:
13971388
return self.plain()
@@ -1406,8 +1397,8 @@ def field(self, size=30, default=None, format=_marker):
14061397
raw_value = Date(default, translator=self._client)
14071398
elif isinstance(default, date.Date):
14081399
raw_value = default
1409-
elif isinstance(default, DateHTMLProperty):
1410-
raw_value = default._value
1400+
elif isinstance(default, DateHTMLProperty):
1401+
raw_value = default._value
14111402
else:
14121403
raise ValueError, _('default value for '
14131404
'DateHTMLProperty must be either DateHTMLProperty '
@@ -1501,18 +1492,16 @@ def field(self, size = 30):
15011492
15021493
If not editable, just display the value via plain().
15031494
'''
1504-
self.edit_check()
1495+
if not self.is_edit_ok():
1496+
return self.plain()
15051497

15061498
if self._value is None:
15071499
value = ''
15081500
else:
15091501
value = cgi.escape(str(self._value))
15101502

1511-
if self.is_edit_ok():
1512-
value = '&quot;'.join(value.split('"'))
1513-
return self.input(name=self._formname,value=value,size=size)
1514-
1515-
return self.plain()
1503+
value = '&quot;'.join(value.split('"'))
1504+
return self.input(name=self._formname,value=value,size=size)
15161505

15171506
class LinkHTMLProperty(HTMLProperty):
15181507
''' Link HTMLProperty
@@ -1558,8 +1547,6 @@ def field(self, showid=0, size=None):
15581547
15591548
If not editable, just display the value via plain().
15601549
'''
1561-
self.edit_check()
1562-
15631550
if not self.is_edit_ok():
15641551
return self.plain()
15651552

@@ -1584,8 +1571,6 @@ def menu(self, size=None, height=None, showid=0, additional=[],
15841571
15851572
If not editable, just display the value via plain().
15861573
'''
1587-
self.edit_check()
1588-
15891574
if not self.is_edit_ok():
15901575
return self.plain()
15911576

@@ -1715,8 +1700,6 @@ def field(self, size=30, showid=0):
17151700
17161701
If not editable, just display the value via plain().
17171702
'''
1718-
self.edit_check()
1719-
17201703
if not self.is_edit_ok():
17211704
return self.plain()
17221705

@@ -1737,8 +1720,6 @@ def menu(self, size=None, height=None, showid=0, additional=[],
17371720
17381721
If not editable, just display the value via plain().
17391722
'''
1740-
self.edit_check()
1741-
17421723
if not self.is_edit_ok():
17431724
return self.plain()
17441725

‎templates/classic/schema.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -106,10 +106,10 @@
106106
def own_record(db, userid, itemid):
107107
'''Determine whether the userid matches the item being accessed.'''
108108
return userid == itemid
109-
p = db.security.addPermission(name='View Self', klass='user', check=own_record,
109+
p = db.security.addPermission(name='View', klass='user', check=own_record,
110110
description="User is allowed to view their own user details")
111111
db.security.addPermissionToRole('User', p)
112-
p = db.security.addPermission(name='Edit Self', klass='user', check=own_record,
112+
p = db.security.addPermission(name='Edit', klass='user', check=own_record,
113113
description="User is allowed to edit their own user details")
114114
db.security.addPermissionToRole('User', p)
115115

‎templates/minimal/schema.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,10 @@
3737
def own_record(db, userid, itemid):
3838
'''Determine whether the userid matches the item being accessed.'''
3939
return userid == itemid
40-
p = db.security.addPermission(name='View Self', klass='user', check=own_record,
40+
p = db.security.addPermission(name='View', klass='user', check=own_record,
4141
description="User is allowed to view their own user details")
4242
db.security.addPermissionToRole('User', p)
43-
p = db.security.addPermission(name='Edit Self', klass='user', check=own_record,
43+
p = db.security.addPermission(name='Edit', klass='user', check=own_record,
4444
description="User is allowed to edit their own user details")
4545
db.security.addPermissionToRole('User', p)
4646

0 commit comments

Comments
 (0)